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(57) Abstract 

A system for distributing copies of computer sof- 
tware provides inherent protection against unauthorized 
copy of the software. The software distribution system 
includes three computers: a host (10), a software protec- 
tion computer (12) and an end-user computer (14). The 
host computer (10) is under the control of the vendor, 
and the software protection computer (12) and the end- 
user computer (14) are located at the customer installa- 
tion. The software is encrypted in the host computer (10) 
and then transferred to and stored in the end-user com- 
puter (14) after it is registered in the software protection 
computer (12). The transferred software is encrypted us- 
ing a unique encryption key. Each copy of a software 
package generated by the host computer (10) is a unique 
encrypted version of that software package. When this 
unique encrypted version of the software package is run 
on the end user's computer (14) and encounters an en- 
crypted portion of itself, it will suspend normal execu- 
tion and transfer the encrypted portion to the software 
protection computer (12). This computer (12) will then 
decrypt the encrypted portions of the code and return 
the decrypted portion of the code to the end-user com- 
puter (14) where that code is itself executed or allows ex- 
ecution of the program of which it is a part to continue. 
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SOFTWARE DISTRIBUTION SYSTEM 

BACKGROUND OF THE INVENTION 

This invention relates to electronic software 
distribution and more particularly to a software distribution 
system in which the distributed software is protected against 
copying. 

Over the past few years , the' grew th of the software 
iftdustry has been enormous, and as more and more- people purchase 
personal computers, the industry is expected to continue to grow 
rapidly. For the most part, purchased software changes hands 
. frcm a mail order ot retail vendor to a customer in seme physical 
form such as a tape, disk or even a printed listing of code. 
Such physical distribution has resulted in a number of problems 
with respect to both the mode of distribution and customer 
servicing as well as with the rights of the creators and 
publishers of the software which is sold. . Principal among the 
problems is that a large percentage of the software which is sold 
ends up being illegally copied. Frequently, a purchaser of 
software will "lend" his copy of the software to a friend who 
makes a copy for himself. The most obvious result of this 
unauthorized copying is that the profits of the creator and 
publisher of the software (who pcobably have a copyright in the 
software) are greatly reduced. To make up for these lost 
profits, the price of the software is maintained at a high level. 
This sustained high price unfortunately produces an even greater 
incentive to illegally copy. 

Copyright protection, which does provide the creator 
and publisher of software with legal recourse against the person 
making the unauthorized copies has, in fact, afforded little or 
no relief frcm the problem of copied software. As the copies are 
often made by individuals for their own use, large-scale policing 
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of such copying is virtually impossible. On rare occasions, a 
copier having a large copy resale operation can be caught, but by 
the time he is caught, many unprotected copies usually already 
have been distributed. Furthermore, the advent of software 
rental shops has further limited the copyright owner's ability to 
protect his rights in the software he cwns. 

Another problem frequently encountered with software 
sold over the counter is the need to later distribute revised 
copies to add new features or to fix errors or "bugs" present in 
the software. These bugs appear despite rather substantial 
testing that is performed before a software package is put on the 
market. These bugs are particularly prevalent in software which 
has recently entered the market. In order to correct any errors 
which do appear in the software, a software publisher must recall 
the disk or tape which contains the faulty software. The problem 
with correcting errors in this manner is that the software is cut 
of the hands of the purchaser for a number of days, if not weeks, 
while the exchange and correction take place. Finally, the 
„ cumbersome nature of this system discourages the user's updating 
of his software which often leaves a bad impression of the 
software publisher's products in the field. 

In order to combat the illegal copying of software, the 
_ software, industry has taken a number of precautio ns. The. v arious 
approaches fall under' three categories: media protection against 
copying, use of read-only media and processor serialization. 

Media protection against copying. refers to making sate 
unique version of the medium containing the software. One type 
of media protection involves the use of variable-pattern 
diskettes. Variable-pattern diskettes, however, do not offer a 
practical solution to the software copying problem since these 
diskettes depend on a soft format diskette drive and they are 
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vulnerable to memory copy if the entire program is loaded at 
once. Furthermore , such variable-pattern diskettes can only be 
used in a small percentage of the drives currently on the market. 
Therefore, the software distributed on such diskettes can only 
be offered to a rather snail percentage of the market. Finally, 
physical alteration of the media, usually by forcing hard errors 
on the media checked for by the software itself, has been used. 
This method fails in that hardware checks in the software can be 
located and neutralized in the software itself. 

Another type of media protection against copying 
involves the use of an operating system override. Such a 
protection scheme depends on a rather unique cperating system 
which prevents copying of diskettes. The use of an operating 
system override, however, has not proven to be the answer to the 
problem either since the altered cperating system must be 
tailored to the particular controller chip of the computer on 
which it is operating, and the cperating system override cannot 
support use with standard operating systems currently on the 
market. In addition, any cperating system override is vulnerable 
to an algorithmic solution or "cracking". One variation on the 
operating system override scheme has the. software employ features 
of the hardware, circumventing the operating system, to check 
areas on the storage media which the cperating system cannot 
reach. This method can also be defeated by being neutralized in 
the software itself. r 

A third type of media protection against copying 
involves the use of segmented programs in conjunction with 
variable-pattern diskettes and/or an cperating system override. 
The use of such segmented programs of necessity requires sane 
type of a segment loader to read in the various segments when 
required. This results in very slow response frcm a computer 
utilizing such segmented programs. Furthermore, any loader 
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routine for reading in segmented programs is vulnerable to 
algorithmic solution. In addition to the problems stated above, 
these media protection devices have generally been perceived as 
being user-unfriendly, and since it is not possible to make a 
legitimate backup copy, such protection schemes are not in wide 
use. 

Another possible solution to the problem of software 
copying involves the use of read-only media to store the 
software. Among the read-only type media which nay be used are 
ROMs and laser cards. The problem with the use of such read-only 
media is that any software update can only be done by replacing 
the media itself, and therefore any software update becomes 
rather expensive. Moreover, there is no legitimate backup for 
any media failure since a backup copy cannot be created. 
Finally, with the use of read-only media, added expenses are 
incurred by the user, since a particular type of reader for that 
media must be purchased at great expense to the user (with the 
exception of ROMS) with that user gaining no significant, 
additional value. 

The third type of protection, processor serialization, 
has also not proven to be a very effective means of protecting 
.software. The reason for the ineffectiveness of this mode of 
protection is. that processor serialization requires either the 
compliance of all computer manufacturers or publisher-supplied 
hardware which canes with the software package to provide the 
serialization. In addition, this protection technique adds no 
value to the computer to compensate for the cost, and there is no 
benefit to the manufacturer for complying with a processor 
serialization scheme. Finally, since serialization involves a 
passive device, it is easy to defeat the serial number check in 
the software itself. 
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In light of the problems encountered with the 
above-described currently existing protection schemes, it appears 
that illegal sales or copying cannot be stopped altogether; it 
can only be made more difficult. The ultimate goal of any 
protection scheme therefore is to make the cost of cracking the 
protection scheme comparable to or preferably greater than the . 
cost of purchasing the software. In order to make cracking costs 
greater than the purchase price of the software, the protection 
scheme must not employ an algorithmic approach which can be 
easily solved. In addition, any add-on hardware must be of a low 
cost nature, and must be ocmpatible with the machines of a 
majority of the major ccmputer manufacturers. 

Therefore, it is a principal object of the present 
invention to provide a software distribution system which can 
.protect software frcm being copied. 

Another object of the present invention is to provide a 
software distribution system in which software is encrypted using 
a virtually indecipherable encryption key. 

Still another object of the present invention is to 
provide a software distribution system in which each copy of the 
distributed software is protected by a unique encryption key. 

v Yet another object of the present invention is to 
provide a software distribution system in which each copy of a 
program is organized in a unique pattern to frustate comparison. 

A further object of the present invention is to create 
a software distribution system in which revisions in software can 
be easily distributed. 



SUMMARY OF THE INVENTION 

These and other objects of the invention are achieved 
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by an electronic software distribution system in which 
distributed program copies are uniquely associated with specific 
hardware to which the end user's ccrtiputer must be connected. A 
centred computer facility operated, for example, by a software 
vendor, contains storage capacity for a library of available 
programs. Auxiliary Software Protection Processors" (SPP) are 
issued to the users. Each SPP is electrically connected to the 
user's computer and electronically interconnected with the 
central facility, for example, via a modem-interfaced phone link. 
Each SPP is equipped with a unique number code referred to as the 
package encryption key (PEK) which is recorded at the central 
facility. The PEK can be factory loaded or down-loaded (via the 
contnunications link) to the SPP frcm the central facility. The 
software distribution system of the present invention embodies 
two distinct unique operations:* (1) software preparation and 
delivery and (2) software execution in the user's computer. 

In the preparation/delivery phase, when a user orders 
software frcm the central facility, the facility first looks up 
the PEK for that user's SPP and selects an available registration 
index number (RIN) which will be unique for that user's copy of 
the software package. The central facility then prepares the 
unique user copy of the ordered program by enccypting passages of 
the program selected by the central facility in a manner such 
that a given algorithm operating on a key specified by a 
combination of the PEK and RIN and an encrypted passsage^ill 
yield the original unencrypted version ("plaintext") of such 
passage. The encrypted version of the ordered program (which is 
encrypted only in a subset of its parts or nodules) is then 
transmitted to the user along with a control block containing the 
RIN. The control block is stripped off and the RIN stored in the 
user's SPP while the transmitted program copy (with its encrypted 
passages) is stored in the user's computer system on. 
user-selected media. 
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In the software execution phase of operation when the 
user desires to run the program, the initial instructions in the 
program check the specific RIN in the SPP associated with that 
program oopy. If the RIN is okay, normal execution proceeds 
until an encrypted passage is encountered. The user's computer 
then executes a call to the SPP in which the encrypted passage is 
decrypted algorithmically in the SPP by use of the key specified 
by the PER and RIN. The decrypted passage is returned to the 
user's computer. If the passage is properly decrypted, normal 
program execution resumes until another encrypted passage is 
encountered. In the preferred embodiment/ these passages may 
actually be software instructions as well as data. 

Time-limited authorization is implemented by means of a 
real-time clock or counter embedded in the -SPP which, for 
example, erases or alters the software-specific RIN after a trial 
period or rental term. Since the unique user copy of the 
selected software cannot run properly unless an SPP with the 
correct PEK and RIN is engaged "with the user's computer system, 
the software package would therefore be disabled. 

These and other features and objects of the present 
invention will be more fully understood frcm the following 
detailed description which should be read in light of the 
accompanying drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a system block diagram showing the various 
components involved in the transmission of information in the 
system of the present invention. 

Fig. 2 is a block diagram showing the communication 
interaction of the various components of the system at the user's 
location. 
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Fig. 3 is a circuit diagram of the software protection 
processor of Fig. 2. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

The software distribution system of the present 
invention provides a means for a vendor to sell software to a 
vendee while providing protection against copying that software. 
As shown in Fig. l f the software distribution system of the 
present invention includes three computers - a host computer 
called the Software Encryption Ccmputer (SEC) 10, a software 
protection computer designated the Software Protection Processor* 
(SPP) 12 and the End-User Computer (EUC) 14. Of these computers, 
the SEC 10 is owned and operated by the vendor while the SPP 12 
and the EUC 14 are owned by the customer and located at a 
customer installation.- The software which is purchased by the 
customer is transmitted from the SEC through a cortrirunication 
system such as phone lines, a local area network or a cable 
system. In the preferred embodiment, the software is received by 
the SPP 12 which transfers the software to the EUC 14 for 
storage. When the software is transmitted over phone lines, a 
modem 16 at the vendor installation and a modem 18 at the 
customer installation are required for sending and receiving the 
software. 



The word "encrypt" is used in this application to 
indicate a process of taking original code and disguising it so 
that it is unintelligible. On the other hand, the word "decrypt" 
is used in this application to describe the reverse process, 
namely transforming disguised, unintelligible code back to its 
original form or "plaintext" in the vernacular of cryptography. 

The SEC 10 is a central ccmputer facility located at a 
vendor site or operated under the control of the vendor. The SEC 
10 maintains a library of software available for distribution. 
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Each time a software sale is made, the SEC 12 encrypts the copy 
of the software before transmitting it to the vendee or user. 
Each copy of software is encrypted in a unique fashion. This is 
true even if two copies of the same piece of software are 
transmitted to the same user. 

Once the copy of software has been encrypted in 
preparation for sale, the copy of the software is transnitted by 
the SEC 10 via the vendor modem 16 to the vendee modem 18 which 
is connected to the SPP 12. The SPP 12 is a self-contained 
decryption computer capable of retaining unique control 
information for each software package purchased by a custcroer. 
The SPP 12 has two major functions. The first of these is to 
confirm the customer's validity and to register control 
information ' for any software package sold to that custcmer. The 
second is to decrypt any encrypted portions of software received 
frcm the EUC 14 which permits that software program to continue - 
operation in the EUC 14. Hence, unless the SPP 12 is engaged, 
software distributed by the distribution system will not operate 
in the EUC 14 . Although the SPP 12 has been described as 
cannunicating with the SEC 10 through a modem 18, the SPP 12 may 
also contain or interface with coronunication devices such as a 
local area network or a cable system. The SPP 12 may also be 
contained within the user's EUC 14 as well. 

The third computer in the preferred embodiment of the 
present invention, the EUC 14, is a customer owned or operated 
ccnputer. This computer may be a hare computer, personal 
corputer, snail business ccnputer or a large main frame computer. 
All software purchased by a custcmer is designed far operation on 
his particular EUC 14. 

In operation, before any software may be sold, the 
custcmer must purchase a modem/SPP unit and its associated 



WO 85/02310 



PGTAIS84/01856 



-10- 

ccrtmunication software in order to make use of the software 
distribution system of the present invention. Each SPP 12 has 
its am unique Package Encryption Key (PEK). The purchased 
mcdera/SPP unit is then connected to the customer's EUC 14, and it 
is simply left in place until the customer -wants to purchase 
software. In the preferred embodiment of the system of the 
present invention, the customer wishing to purchase software 
connects his modenv/SPP with the system's SEC 10 via telephone. 
The modem/SPP 12 passes its unique identification code 
(prefereably in encrypted focm) to the SEC 10 to confirm the 
identification and the legitimate status of the custcraer. The 
SEC 10 then generates lists of available software packages along 
with prices and terms of sale. These prices and terms of sale 
(usually credit card authorization) must be agreed upon before a 
transaction actually occurs. Once the customer has met the terms 
of the sale, the SEC 10 creates a unique copy of the specified 
software package, and this package, which also contains encrypted 
security control information, is transmitted through the 
customer's modertv/SPP into his EUC 14. The preparation of the 
unique copy is accomplished by encrypting selected passages of 
the software. First, the SEC looks up the unique PEK for the 
user's SPP. Next, the SEC selects an available Registration 
Index Number (RIN) specific to the user's software copy. 
Passages are encrypted in a manner such that they can be 

, decrypted by the SPP using its PEK modified by th e • 

package-specific RIN. 

When the EUC 14 begins to receive a unique copy of a 
specific software package, the EUC 14 sends the control 
information block which arrives first to the SPP 12 for 
registration. Included in this control information is the 
encrypted Registration Index Number (RIN) which is decrypted by 
the SPP 12 and stored in its memory. After the control 
information has been decrypted by the SPP 12, the remainder of 



WO 85/02310 



PCT/US84/01856 



-li- 
the transmission, the encrypted software package itself, is then 
passed through the SPP 12 to the customer's EUC 14 for storage on 
user-selected media. Each time the customer runs software 
purchased frcm the SEC 10, his SPP 12 must also be connected and 
that SPP 12 must be the same SPP 12 which was used when 
purchasing the software initially. If either of these conditions 
is not net, then the software will not operate on the EUC 14 
because the PEK and the RIN for decrypting any particular 
software package are only stored in the SPP 12 which was used for 
purchasing that software. 

The two phases of operation are summarized in the 
following Tables I and II. 

TABLE I ' 

Software Preparation and Delivery Phase 

1. User with modem/SPP calls SEC. 

2. SEC verifies SPP identification number. 

3. User selects software from menu. 

4. SEC looks up PEK for user's SPP. 

■i - 

5* SEC selects available RIN for user selected 
software. 

6. SEC encrypts selected passages of software 

in a manner such that they can be decrypted by 
SPP by algorithmically conbining encrypted 
passage with. key generated by modifying PEK 
with RIN. 
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7. SEC transmits control block with encrypted version 

of RIN, followed by software with encrypted * 
passages. 

8. EUC passes control block to SPP. 

9. SPP decrypts and stores RIN in its memory. 

10. EUC stores software with encrypted passages 
on disk or other media. 

TABLE II 
Software Execution Phase 

1. EUC loads program off disk or other media. 

2. Initial module of software tests decryption 
by sending data to SPP. 

3. SPP looks up corresponding RIN and decrypts data 
with key formed by modifying PEK with that RIN. 

4. Software tests returned data and halts execution 
if data are incorrect. 

tformal~pfo^am executidr^ 
passage encountered. 

6. At encrypted passage, software jumps to a 
decryption module which transfers data or 
instructions to SPP and gets decrypted data 
or instructions in return. 

7. Resume nocmal execution until next encrypted 
passage. 
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The Software Protection Processor" (SPP) 12 is the 
heart of the software distribution system of the present 
invention since it is the SPP 12 which provides intelligible code 
to the EUC 14. As shown in Figs. 2 and 3, non-volatile 
read/write memory 22 is provided in the SPP 12 for storing a 
valid software list. This non-volatile read/write memory may be 
implemented in an electrically erasable programmable read only 
memory (EEPROM) so that the list can be updated with each 
purchase. The EEPROM 22 will also include a publicly accessible 
serial number and the PEK. In the preferred embodiment, a 
clock/timer 24 is also included in the SPP 12 to implement 
time-limited authorization so that software can be used on a 
trial or approval basis or rented for a certain predetermined 
allotted time. The clock/timer 24 is provided with a battery 
backup. By using such a clock/timer 24 the current time will be 
updated with every connection to the SEC 10. If there is no 
battery backup and power to the clock/timer 24 is lost, it is 
necessary to reconnect to the SEC 10 before any rented software 
can be run. In addition to the non-volatile read/write memory 
mentioned above, the SPP 12 will also include a non-volatile 
read-only memory (ROM) 26 for storing the SPP's operating 
program. An illustrative operating program in Z-80 assembly 
language is given in Microfiche Appendix Part I. If it is 
desired to provide for later update of the SPP's operating 
''''"'program, however, then ah EEPROM can be substituted for the ROM 
26 which contains the cperating program. 

The SPP 12 also includes a Z-80 microprocessor 28 which 
controls the functioning of the SPP 12. This microprocessor 28 
will communicate with both the SEC 10 through modem 16 and with 
the EUC 14. Appropriate communication interfaces 30, 32 (Fig. 2) 
are provided between the microprocessor 28 and modem 18 and 
between the microprocessor 28 and the EUC 14, respectively. 
These communication interfaces include a dual asynchronous 
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receiver transmitter (DART) 34. The DART 34 ccnrnunicates with 
the EUC 14 and the SEC 10 through lines 36 connected between the 
EUC 14 and the SPP 12 and through lines 38 connected between the 
SEC 10 and the SPP 12. The DART 34 is linked to the 
microprocessor 28. Input/output addresses are decoded by. circuit 
40. A baud rate generator 41 is also included for appropriately 
matching the modems 16 (Fig. 1> and 18. 

The microprocessor 28 preferably includes its cwn 
working randan access memory (RAM) and it has the ability to 
execute a program out of either EEPROM. RAM 42 is provided as 
working storage for microprocessor 28. This RAM 42, as well as 
EEPRCMS 22, 26 are linked to the microprocessor 28. Memory 
addresses are decoded by circuit 44. 

Clock circuts 46 f 48 drive microprocessor 28 as well as 
the baud rate generator 41. A lOmSec delay circuit 50 is also 
connected to the mi crop rocessor 28 which introduces a delay 
whenever a write operation is directed to EEPROM 22. 

In the preferred embodiment, the modem 18 is included 
in a "black box", with the SPP. This modem 18 takes data frcm the 
microprocessor 28 and transmits it over phone lines, and the 
modem 18 receives data transmitted over the phone line and passes 
it on to the micropro cessor 28. While a ll of the above e lements 
of the SPP 12 have been described as individual components, most, 
if not all, of these functions may be implemented on a single 
chip or small number of single chip microcomputers. 

Another aspect of the present invention which requires 
special consideration is the Package Encryption Key (PEK) which 
is created for each customer and his SPP by the SEC 10. This key 
will be rather large, preferably on the order of 256 bits. Scire 
or all of the bits of the PEK will be used to perform one or more 



WO 85/02310 



PCT/US84/01856 



-15- 

operations on a section of the code having a corresponding number 
of bits. 

For example, if a key of 256 bits is used, the SEC 10 
will select portions of the program to be encrypted which also 
have 256 bits. An operation, such as exclusive ORing (EOR) the 
two 256 bit codes, is then performed and the resulting 256 bits 
is inserted into the program at the position frcm which the 
selected 256 bits were removed. It is this encrypted version of 
the software package which is sent to a customer. In order to 
decrypt this code, the SPP 12 will perform a reverse operation 
using the 256 bit key and the encrypted 256 bits. In the case 
where the original operation was an EOR, the reverse operation is 
also an EOR. The specific key which is assigned to each customer 
will be stored in the SEC 10 and this key will be used by the SEC 
10 when creating each encrypted version of software. 

The valid software list which is maintained by the SPP 
12 in EEPROM 22 includes an RIN for each entry into the valid 
software table. This RIN points to a location in the PEK. For 
example, if a one byte RIN (0-255) in the valid software table 
for a specific software package is 108, then the program's 
encryption will be performed using a key which begins at the 
108th bit of the customer's PEK. In one embodiment, as each 
program is sent to the EUC 14, it will be given the next 
consecutive available RIN for the PEK. In other words, the first 
program in the valid program table will be given a one byte RIN 
of 1 into the PEK, the second program sent to the SPP' s valid 
software list will be assigned an RIN of 2 for the PEK and so on. 
The assigned keys will remain the same size since the ends of the 
PEK are simply "wrapped around" so that the new end of the PEK is 
the bit immediately preceding the beginning bit of the PEK. 

To summarize, the actual encryption key is a function 
of the user-specific PEK and the software-specific RIN. The RIN, 
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in this embodiment, simply designates a starting location in the. 
PEK. Other means of combining RIN and PEK to obtain the 
software-specific encryption key are possible. 

Besides encrypting software with a unique PEfs/RIN key, 
the software distribution system of the present invention will 
provide additional safeguards against copying. For example, 
since most programs are constructed from small, interrelated 
modules, portions of each module may be separately encrypted by 
the SEC 10. These modules may then be linked together by a 
linkage editor which basically keeps a list of the beginning and 
end addresses of all modules. When an end of a module is 
reached, a jump ccnmand to the beginning of the next appropriate 
module may then be put into effect. In this manner, all- the 
modules are tied together. In fact, once such -modules are 
linked in this fashion, the individual modules lose their 
identity and the program appears to be monolithic. Therefore, to 
further complicate any attempt to copy software, the software 
distribution system of the present invention may scramble the 
order of the modules cn a random or other basis. In this way, 
any person gaining access to two copies of the same encrypted 
software package sold by the SEC 10 will not be able to ideate 
the sites of encryption by simple comparison. 

A concrete example of program encryption and module 
randemizatioft is presented in Part II of the microfiche appendix. 
Five sample modules aire incocporated in a program called "MAINl". 
The program is designed to run on a MSD0S system such as that 
used on the IBM PC. The unencrypted object code for the program 
is stated in hexadecimal digits on pages 1-13 of Part II of the 
microfiche appendix. To prepare this software for delivery, a 
special "security control module" (pages 17-19) is added to 
handle all calls to the SPP. The security control module acts 
like a subroutine. Actually, this subroutine engages the 
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" subprogram" in the SPP to decrypt the encrypted passages. To 
illustrate an encrypted passage, special print data (a part of 
the software) is presented in connection with modules 1 and 4. 
As shown on page 16 of Part II, two sets of "external character" 
data are created namely "*messgl" and "*messg4" in place of the 
plain text version "This is " module 1 or 4, respectively . (See 
page 16, Part II,) Before encryption, the print data resides 
correctly in program memory beginning at hex location 2762 (page 
12, Part II). After encryption, the first eight bytes of the 
print data for modules 1 and 4 is encrypted as shewn for module 1 
in locations 2762-2769 (page 31, Part II). The encryption was 
performed by exclusive ORing. The original eight bytes • 
(representing "This is " with the 64 bit (eight bytes) PEK 
" AAAAAAAAAAAAAAAA" . In binary this nonrandem PEK is "1010 ... " 
Thus the eveh/oddness of the RIN determines whether the 
decryption key starts with "0" or "1". The encrypted code on 
page 31 was produced using an even RIN of 1234 and the encrypted 
code for the scrambled module format was produced using an odd 
RIN of 4321. When using either encrypted program "MAIN1E" or 
MAIN2E", when running the user's copy, the security module is 
called upon reaching "*messgl" or H *messg2" and the encrypted 
bits are sent out to the SPP and exclusive OR'd with the key 
(i.e., either "101 ... " or "0101 ..." depending on the RIN in 
use), and returned to the user's computer in decrypted form as 
the equivalent of "This is ". Note that while a 
lbcaition-by-locatioh comparison of "MAINl" (unendrypted) and 
"MAINlE" could 'reveal the encrypted locations, this type of 
comparison is rendered more difficult by scrambling the order of 
the modules as in "MAIN2E". In practice, it is intended that a 
longerrandcm number PEK will be used and executable instructions 
as well as program data will be enccypted in a similar manner. 

The foregoing system thus solves the problem of secure 
distribution of software to users by associating each unique copy 
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with, specific hardware to which the end user's computer must be 
connected. Copies of the user's program copy will only operate 
when the SPP with the right PEK and RIN is attached. When used 
in a phone line network, the system provides a powerful means of 
providing on-going service to users. For example, the user can 
-be notified of and provided with software enhancements via the 
network as. soon as they are available. Moreover, the SPP 
provides for time-limited authorization. At the end of a trial 
period or rental terra, the RIN for the borrowed software is 
cancelled, thus disabling further use. 

Among the various other possible configurations of the 
present system are local area networks. Modem ccrtmunication is 
not the essential embodiment of the invention, only the preferred 
one. The invention also lends itself to use as a terminal 
verifier. Instead of using a password, the SPP can be used to 
decrypt a code from a host computer and retransmit a decoded 
password to the host to verify authorization for access to secure 
data, for example. 

Employing EEPROM's in the SPP opens up the possibility 
of downloading completely new software for cunningi the SPP. Even 
new PEK's can be added by "remote control" frcm the SEC. r Thus, 
the SEC maintains control over the cryptographic system infuse by 
the SPP. For e xample, in addi tion to the exclusive OR algorithm, 
new algorithms with entirely different, perhaps more complex 
logic functions, could be added, including nonreversible keys. 

While the software distribution system of the present 
invention has been described with reference to its preferred 
embodiments, various modifications and alterations in both 
hardware and software will occur to those skilled in the art from 
the foregoing detailed description and the accompanying drawings. 
These and other modifications and variations are intended to fall 
within the scope of the appended claims and equivalents thereto. 
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PART J 



:o(»ndt SPr cod* 



apop 
. pabs 
.dink 
. ph -* 



RAH 

HAM52 

CCPROM 


equ lOOOh 
equ 600h 
equ COOh 


CTCO 

crr.x 

CTC2 
CTC3 


• qu 

• qu 

equ 
equ 


i Oh 
t ih 
12h 
13h 


SIODA 

srncA 

51008 
SIOCB 


equ 
equ 

• qu 

• q u 


OOh 
Oth 
02h 
03h 


r.tRQA 
CinBO 


equ 
equ 


RArU400h 
RAMOOOh 


KOOESC 
S3CCNT 
CflOCHT 


equ 

• qu 

equ 


3 

10000 



; ci rcuUr buffer (or a to b direction 
ictrcuUr bursar for b to & direction 

;aodem mod* escape char 

;number of modem chars needed 

;guard band count (about 1.5 seconds) 



i pn I « : 
opn I ft : 
ipntb : 
opn tb : 

grdtrar : 
grdf I g : 
count : 

curke y : 
crypb f : 



key. 
sf tlst 



start: 



ma i n : 



d sp t c h : 



dsptcl : 



org HAM 
.blkb 2 
.bllcb 2 
.blrfc 2 
.blkb 2 

.blkb 2 
.blkb 1 
.blkb 1 

.blkb 1 
.blkb 0 

org SCPaOK 
.blkb 0 
.blkb 7*0 

org OOOOh 

lxl sp f RAM* RAMS Z 
call inl t 
lxi h.CIRBA 
shld ipnta 
sh 1 d opn ta 
lxi h,CinOQ 
shld Ipntb 
shld op n tb 

call ge ta 
mo v c # a 
lxi h,cmdtbl 
c&ll d*ptch 
jmp main 



mv 1 a , - 1 
cap m 
r*. 

nov a,c 
cap m 
j z dsp tc I 
inx h 
j nx h 
inx h 

imp dsptch 
Inx h 
mov a,m 
inx h 
mov h,ro 



; input circular buffer pointer for a to b direction 
;output circular buffer pointer for a to b direction 
;input circular buffer pointer for b to a direction 
;output circular buffer pointer, for b to & direction 

;guard band timer 

;set to - 1 if last char was guard band 
; number of escape ch^rs 



;key In currant use for now, 

;buffer for encrypt operation 



just use I byte 



;Q byte key 

;software list -- 0 entries of 7 bytes 



; set up etc and p to 

;init circular, buffer pointers 



; to c 

; d i spa tch table 
;call 



char on channel a 
tch table 

appropriate routine 



; end o f 
; to a t c h 



table, Ignore 



; get address, and jump there 
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cmdtbl : 



db 0 



cmrf tb I ; 



dw ret st 
db I 

dw encrypt 
db 2 

dw qettime 
db 3 

dw selkey 

db 4 

dw update 

db 5 

dw set time 
db 6 

dw rd 1 i s t 
db 7 

dw modem 
db -1 

db * 0 * 
dw re ts t 
db • 1 * 
dw encrypt 
db '2' 
dw gettina 
db '3 ' 
dw selkey 
db *4 ' 
dw update 
db '5 ' 
dw stttimi 
db '6 • ' 
dw rdiist 
db '? ■ 
dw modem 
db -1 



; return sta tug 

;retttrn encrypted response 

; citurn time and date 

;select key 

;update software list 

;set time and date 

;return rottwict list 

;go to modem mode 

i 

;return status 

; return encrypted response 

; return time and date 

;select key 

;update software list 

;set time and date 

.-return software list 

;go to modem mod 4 



retst. 



mv £ 4 , ' 5 * 
ca.il put* 
ret 



• nc ry p t : 



encrt : 



enc r 2 : 



mv i c,B 
Ixi h , cr ypb f 
Ida curkey 
mo v b , a 
call get* 
rra b 
mo tf m , a 
in* h 
dcr c • 
jns encri 

mv I c , 0 
Ixi h , c r ypb f 
mo v a ,ia 
call puta 
i nx h 
dcr c 
jnt encrl 
ret 



; re turn s ta tus 

;return status '3* for now 



; return encrypted response 



;get C bytes to encrypt 
;encrypt it 



;s*nd baclr encrypted by Us 



selkey: select key 

call qa t a , get indev into sol twiri list 



mo v b~, a" 
call q* t a 
nov a. » b 
ana <a 
jnt selkl 
Ida V e y 
sta curkey 
ret 

sel k i ca 1 I qtlist 
nov c.m 



# an>l most significant p*ct i Jon' t use it Cor now) 

, ind** of 0 means use dcfiuli key 

.return pointer to entry in software list 
i i nd est into key 
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mv i b , 0 
lxi »t -key 
•Ud b 

mow i,m ;g*t key 

5 t a cue ki y 

ret 



jllifii: 



g 1 1st 1 : 

upditi: 

up da 1 1 : 
upda 1 2 : 

wr tp rm: 

wr tp c 1 : 
wr tp r2 : 

rdllst; 
rd t s t 1 : 



;ent*r with mdei into software list (only l-C legal) In reg * 
;ceturn pointer to soHwiri list 



I k I h, et t 1 sX 

dCC a 

r t 

ani 7 

I xi d , 7 

dad d 

dcr * 

jnx o.t 1 sM 
rot 



ca 1 I ge t a 
call g t 1 i & t 
mv 1 c , 7 
ca 1 1 4* ta 

call wr tp rm 
in* h 
dcr c 

jnx u p d a 1 1 
ret 



; wr I t e rag 

push b 
mv i m,0ffh 
mv i c < 0 
dec c 

jnt wrtprl 
mov m, a 
dcr c 

jns wrtpr2 
p 6 p b 
ret 



^beginning of soMwir* list 



.only 0 possible entries 

; s i « e o f entry i n list 

, fin»J beginning of appcoptlat-a entry 



;update software list 

;get index into list 

;get beginning of that entry 

;now gel 7 software list entries 

•fill in entry 

;wr I te reg a to eeprom address In hi 



mv i c » 6 4 
lxi ti.key 
nov a,m 
call pu ta 
inx h 
dcr c 

inx rdlstl 
ret 



to eeprom address in hi 
;write ff first to erase eeprom 



; now del ay a whi 1 e to 



allow monos table its duty cycle 



return software list 
. ; 0 byte key + 



— for now, return key too 
>A software list entries 



;not yet implemented 
qe 1 1 Ime : 
se 1 1 ime : 



jreturn time and date 
; se t t ime and date 



ret 



mo dec; 



modemt : 



sub a 

s t a grd f I g 
sta count 



modem2: lxi h,GnoCNT 
shld grdtmr 



in SZOCA 
ani 4 
ens snda 
In SIOC3 
ani 4 
ens sndb 
in 3I0CA 
ani t 



;init guard band detect variables 

init guardband count 

;chann»l A status 
; r eady to s end on a 

; ready to send on b 
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oodcm5 : 



Ji mod*m3 

cill rcvi 
cp I HODCSC 
jnx modem 
Id* grdflg 
cp I — 1 
jnz mo dam 
lxl h. count 
inr m 

jmp no deal 

in SIOCI1 

ens revb 

Ihld grdtmr 
dcx h 

shld grdtmr 
mo v- a . h 
or* I 

jnt mod Ami 

mvi a , - I 
sta grdf Ig 
Ida count 
cpi ESCCMT 
rs 

jmp mod Ami 



; escape to command mod* char? 
;no — reset t wi^, 
;guard band precede this? 

;no — reset 

;yes. advance escape count 
;inlt guard band count again* 



;re&dy to receive on b 
;decrement guard band timer 



;now have a guard band 

;right tscap* count? ^ nAm 
;y*3. return to command mode 
;uo. continue 



snda : 



sndb : 



revb : 



;send on a if char raady in b input buffer 
; no chars ready 

.update circular butter pointer 
; Bj end on b if char ready in a input buffer 
;no chars ready 

;update circular buffer pointer 

returns char In reg a 



Ihld opntb 
Ida ipntb 
emu I 
c t 

mo v a . m 
out SIODA 
inr I 

rfhl'l opntb 
ret 

thld opnta 
Ida tpnta 
cop 1 
r c 

luov a«m 
out SIODB 
i nr I 

shld opnta 
ret 

; ricftiu* char on channel a 
Ihld tpnta 
in StODk 
mo v m , a 

sMdSpnt* .update circular buffer pointer 

ret 



Ihld ipntb 
in SIOOB 
mo v m . a 
inr I 

shld ipntb 
_rot 



;recelve char on channel b 



;update circular buffer pointer 



puta : 
pu tal : 



;channel A status 



;send char in reg a on channel a 

push psw 
in SIOCA 
ani 4 
js puta I 
pop psw 
out SIOOA 
let 
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t4 . ; «jet char from channel a to reg * 

9 in SIOCA 

ink l 
H <jeti 
In SIODA 
ret 

Inil- ; init CTC and 510 

""" ~j;;jm^<m®tt*t* sj?.., 

iVl S?l2 Mi« constat 

»ii ST5%00tOlb .counter mode, load time constant ne.t. no int 

mv i STli Mlm. constant 

out CTCl 

;inlt SIO channels A. and 0 to asynch 
mv i a , I 0h , ' 

out SIOCA • 
m? i a , 4 t 

m?l alSlOOOiOOb clock, I 'stop bit 

out SIOCA 

mv i a . 3 

lv\ a!?"0000lb ;R> enable, 0 bits/char 

out SIOCA 

mv i a , 5 

avl !!o"oiOOOb ST. .n.bl.. 0 bils/ch»r 

out SIOCA 

mv i * , i 0 h 
out SI0C3 
mv I a*fl 

iUl t!oi000100b M*« clock, 1 stop bit 

* out 5IOC3 
mv I a, 3 

ill a!l?00000lb in. enable. 0 bits/char 

out SIOCS 
. mv i a , 5 

1*1 5!ot?01000b ;Tb enable, C bits/char . 

out SIOCD 

ret 

end 
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PART TI 

EXAMPLE OF PROGRAM ENCRYPTION AND MODULE RANDOM! ZAT TON 
Property of soFTNET tm ,Tnc. 

Figure 1 The proqrara "MAIN** unencrypted and in 
object 'code. Its PEK is 

AAAAAAAAAAAAAAAA in hexadecimal code. 

Figure 2 Five sample modules which are part of 
M MAIN". They are unencrypted and. in 
object code. 

Figure 3 These five modules in source code (the 
"C M Language). 

Figure 4 "MAIN'S" security control module in 
object code. 

Figure 5 The security control module in source 
code ("8086 Assembly Language"). 



Figure 6 The program "MAIN" encrypted with its - 
security module and sample modules in 
order 1*2, 3,4 ,5, Security coded in object 
code. The RIN used is 1234. 

Figure 7 The program "MAIN" encrypted with its 
security module arid sample modules in 
order 1,3 ,5 # Security,2i4 coded in object 
code. The RIN used is 4^21. 
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Oump of MAINl.EXE/H 

fl- 4D 5A B0 Bl 16 00 04 00 20 00 IB 00 ™ ™ ™ « MZ -- 

I !I ii II II If II IS II tl 11 II ii si II ii is ~:iEi; 

I li II I! 11 11 II si II ii is II If 11 is if || Eiiii = 

111 ii II ii 11 II ii ii ii I| If If II II II II II ii 

A0s 00 00 0B 00 00 08 00 00 0» 00 !",!"•!! I! 

BB 00 oo oo 00 00 oo oo oo a» 00 00 fl ? ?? ™ ™ 

eo- 00 00 bo 00 oo oo oo 00 00 oc 00 o« " 0 00 22 22 

». 00 00 00 00 oo 00 00 00 00 00,00 00 m NN oo 

E0- 00 00 00 00 00 00 oo 00 00 0° 80 1,0 00 00 „„ „" 

■II'. 11 la oo oo oo oo 00 00 00 00 00 00 no 00 00 00 

ibS II " 00 00 00 0" 00 00 00 00 00 z z 2 Z Z ::::: 

„. aa BO 00 00 00 00 OB 00 ,00 00 00.00 00 00 00 00 

• S SS SS SS SS S SS 8 SS S S :::::::: :::::::; 

i I SS SS S! SS SS SS SS SS SS SS S S :::::::: :::::::: 

igsSSHsss-HHssssss iiiiiiii iii!!!!! 

I ii ii ii ii ii ii ii ii ii il Si H IS :::::::•:::::::: 

III: II 11 ho 00 00 00 00 00 00 00 00 00 00 00 00 00 :• 

i SSSSSSSSSSSS SS SS SS 25 SS SS SS S :::::::: :::::::•: 

Si a s° a a a a s a a SS 3 a;^- 

r ?i SI K 5f SS g SS " SS SS S SS 5 ?« S 

SiSsSiiSSSi! SSSSSSSK :£.«::£ £ 

«n. PP 28 E3 8B PC C6 05 63 47 E3 OD C6 05 20 47 2S .+.....= 

Ia 84 88 05 46 47 F.2 F7 33 CH 8fl 05 BC D8 BR C0 ' * " * • 3 

! L° S SS SS SS S « S S X SS S R ::!::::: 

Si S Si IS 2f.II S-S SS g SS IS g K S S :: :i: : jS::;: 

S s 5 Jl SS 5 SMS S °S SS SS S S.S 5 SS J: 

2D0* EC B8 SB 00 50 E8 CD 02 BB E5 5D C3 B0 00 E8 4C •'•*•') " a " 

00 B8 4C 00 3C EA 75 28. BO 03 BB 40 00 B8 E4 EC ..L.<.u( . ; . a .--- 

»S; SS 3 B A 0 S bJ.M.M 35 00 BB 72 00 8D 16 70 00 C4 ...... 5. 

tfln- 1-7 83 C3 04 31 C9 8A OF 43 R8 06 00 4A 75 F0 C3 " ~ & 

1 S..5c TC » FE B0 01 E8 13 00 51 1 BO OB 00 26 AC .L...... ..O.-.*. 

320: E8 OA 00 E2 F9 59 E8 07 00 AA B2" PA C3 E6 7B C3 J. 

330: E4 7B C3 55 83 EC 0C 8B EC 8B 76 10 8A 04 30 E4 .l.u 



Figure 1 



, „ OMPI 

/a^ wipo 
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340: 

350: 

360: 

370: 

380: 

390: 

3A0 

3B0 

3C0 

3D0 

3E0 

3F0 

400 

410 

420 

4 30 

4 40 

450 

460 
470 

480 
490 
4A0 

4B0 

4C0 

4D0r 

4B0 

4F0 

500 

510 

520 

530: 

540 

550 

5*60 

570 

580 

590 

SAO 

5B0 

SCO 

5D0 

5E0 

5F0: 

600 

610 

620 

630: 

640: 

650: 

660: 

670 s 

680: 

"690: 
6 AO: 



40 8B F8 
10 EB E6 
E9 79 01 
C7 06 24 
8A 85 22 

02 BB OA 
00 03 C3 
8B 76 10 
F0 8A 84 
10 00 7D 
88 00 FF 
AC 00 8B 

75 09 B8 
8B 76 10 
F0 8A 84 
10 00 7D 
99 00 FF 
40 Al 82 
84 AC 00 
20 40 8B 
46 10 EB 

03 E9 14 
10 8A 04 
74 2A 8B 
30 E4 25 

04 30 E4 
B8 88 00 
53 89 46 
53 89 46 
B8 01 00 

76 0A B8 
13 04 SB 
50 E8 B5 

88 00 30 
0D 04 00 
76 08 8A 
8A 44 06 
36 82 00 
83 C4 0C 

89 46 0C 
EC 00 8B 
46 06 89 
25 00 75 
4B 85 DB 
FF 06 2E 
06 E8 20 
8D 46 0E 
46 OA 75 
8B 46 04 
85 DB 89 
8B F0 8A 
OE 30 E4 
ED BB Al 

— 02-FF-O6 
2E 02 50 



8A 85 
C7 06 
8B 76 
02 00 



30 
F7 



A3 24 
8A 04 
22 01 
0E FF 
46 10 
76 10 
EC 00 
8A 04 
22 01 
0B FF 
46 10 
00 FF 
8B 76 
F8 8A 
OF' 3D 
FF 3D 
30 E4 
76 10 
08 00 
85 C0 
50 E8 
06 E8 
08 E8 
50 EB 
F0 00 
E5 83 

03 8B 
E4 85 

88 44 
44 06 
30 E4 
E8 EC 
5D C3 
8B B6 
DB 89 
9K 12 
34 FF 

89 46 

02 88 

04 8n 
50 FF 

03 E9 
3B 46 
IE 30 
42 OE 
DB 2E 
30 02 

I— 2B-02 
FF 76 



22 01 30 
82 00 00 
10 8A 04 
00 8B 76 
E4 25 04 
EB FF 46 
02 EB CE 
30 E4 85 
30 E4 25 
46 04 8B 
EB C9 8B 
46 8A 04 
FF 46 10 
30 E4 85 
30 E4 25 
46 04 8B 
EB C9 8B 
06 82 00 
10 8A 04 
85 22 01 
3E 00 75 
3D 00 75 
FF 46 10 
8A 04 30 
74 05 FF 
74 03 E9 
CO 01 8B 
BD 01 8B 
AD 01 8B 
65 03 8B 
50 E8 Dfl 
7B 08 00 
E5 B8 01 
CO- 75 0E 
06 AO 99 
30 E4 0D 
0D 04 00 
FC BB E5 
55 81 EC 
12 01 8A 
5E 00 43 
01 74 



86 
06 
04 



03 
12 01 
89 IE 
30 E4 
E5 EB 9B 
B6 12 01 
7C FF C7 
08 7C 03 
02 78 13 
88 07 30 
02 53.50 
48 85 CO 
BB-46-06 
06 E8 



88 



E4 25 08 
00 83 3B 
30 E4 E9 
10 8A 04 
00 75 03 
10 8A 1C 
FF 46 10 
C0 89 46 
08 00 75 
F0 8B 7B 
76 04 C6 
30 E4 3D 
A3 86 00 
CO 89 46 
08 00 75 
FO 8B 7B 
76 04 C6 
Dl E0 8B 
30 E4 85 
30 E4 25 
03 E9 66 
03 E9 Dl 
C6 04 00 
E4 40 8B 
46 10 EB 
7F FE EB 
E5 FF 36 
E5 BB EC 
E5 85 C0 
E5 83 7B 

03 8B E5 
75 15 FF 
00 50 £8 
8B 76 06 
00 30 E4 

04 00 88 
88 44 06 
33 CO SO 
0E 01 8B 
04 30 E4 
8A 04 30 
E9 A7 00 
8A 07 30 
30 02 7H 
EB A9 B8 
8D 46 08 
E8 SB 05 
46 04 00 
E9 68 PF 
SB IE 2E 
E4 EB 12 
B8 B9 03 
A3 30 02 

^88 -04—30 
03 BB E5 



00 74 
82 00 
17 01 
30 E4 
E9 10 
30 FF 
C7 46 
00 74 
IB 8B 
10 8A 
84 88 
3E 00 
C7 46 
00 74 
IB 8B 
10 8A 

84 99 
F0 8B 
C0 89 
08 00 
FF 3D 
FE EB 

85 CO 
FA BA 
E6 BB 
00 BB 

86 00 
00 53 
89 46 
06 00 
B8 01 
76 OA 
F8 03 
8A 44 
85 Cfl 
44 06 
B8* AC 
F.8 A7 
KC 80 
115 Cfl 
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What is claimed is: 

1. A method of distributing software via an electronic 
ccrrmunications network frcm a central facility with storage 
capacity for a library of available programs to a plurality of 
users' computers such that each distributed copy is usable only 
on specific user hardware/ comprising the steps of 

responding to a specific user request for a specific 
software program by generating a unique index code and preparing 
a unique user copy by encrypting selected passages of said 
program in a manner such that a given algorithm operating on said 
encrypted passage and a key specified by said index code will 
yield the plaintext version of said passage , 

electronically transmitting said index code and said 
program with encrypted passages to the user, 

registering^ the index code in an independent auxiliary 
device interconnected with the user's computer, 

storing the transmitted program with encrypted passages 
in the user's computer system on user selected media, 

when running the program with the encrypted passages on 
the user's computer, suspending normal execution at each 
encrypted passage and decrypting the encrypted passage by means 
of the auxiliary device ty algorithmically combining the key 
specified by said index code with the encrypted passage and 
returning plaintext to said user's computer, and 

continuing normal execution until encountering another 
encrypted passage, 

whereby each user gets a different copy of the same 
program but no user ever has a complete plaintext version 
residing at any given time in the user's system memory so that 
each program copy is wedded to a specific user's auxiliary 
device. 

2. The method of claim 1, further comprising the step 

of 
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issuing differentiated independent auxiliary devices to 
said users having unique decryption master codes recorded at the 
central facility, 

before preparing software for delivery, identifying the 
user's independent auxiliary device and looking up its decryption 
master code, 

then preparing the unique copy by encrypting passages 
of the user selected program in a manner such that a given 
algorithm operating on (1) a key produced by a combination of the 
index code and the user's master code and (2) the encrypted 
passage will yield a plaintext version of the passage. 

3. The method of claim 1, further comprising 
automatically removing the index code frcm the. independent 
auxiliary device upon the occurrence of a predetermined . 
condition, 

whereby the user's copy of the program is automatically 
disabled, for example, after a predetermined time interval. 

4. The method of claim 2, wherein said issuing step 
includes factory loading each independent auxiliary device with a 
different decryption naster code and recording each such master 
code at the central facility. 

5. The method of claim 2, wherein the issuing step 
includes selecting the decryption master codes at the central 
facility after distribution of the independent auxiliary devices 
to the users and electronically transmitting a unique naster code 
to each of the independent auxiliary devices upon its initial 
request for software. . 

6. The method of claim 5, wherein the step of 
electronically transmitting the decryption master code includes 
transmitting an encrypted version of the master code and 
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decrypting the master code before storing it in the independent 
auxiliary device. 

7. The method of claim 1, wherein at least some of the 
encrypted passages of the program are software instructions 
themselves. 

8. The method of claim 1, further comprising the step 
of scrambling the order of the modules in the user's copy before 
transmission to frustrate comparison with the original version of 
the program. 

9. A software protection processor for an end user 
canputer comprising 

means for storing a unique package encryption key 

(PEK) f 

weans for receiving and storing a. registration index 
number (RIN) uniquely associated with a specific software 'program 
to be stored in the end user's computer system, 

logic means for modifying the PEK with the RIN to 
produce a specific decryption key, 

canputer means responsive to the presentation of 
encrypted data by the user's canputer for decrypting said data by 
algorithmically combining it with the specific decryption key to 
produce a decrypted data output to said user's computer during 
program execution ty the user's conpiiter" " ~ 

whereby a unique copy of software chosen by the user 
can be prepared by a central facility by encrypting selected 
passages of the software in a manner such that they can be 
decrypted by the software protection processor by algorithmically 
combining them with a decryption key produced by modifying the 
PEK with the RIN so that the user's copy will not run properly 
unless his computer is connected to a software protection 
processor with a correct PEK and RIN. 
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10. The apparatus of claim 9, further ocnprising 
means for disabling the software specific RIN upon the 

occurrence of a predetermined condition, 

whereby the selected software is disabled after, for 
example, a predetermined trial period or rental term. 

11. A data security apparatus for a user's computer 
having a communications link with a central computing facility, 
comprising 

an independent auxiliary device electronically separate 
from but connected to the user's computer including 

means for storing a unique first code, 

means for receiving via said communications link a 
second unique code, 

means for modifying said first code with said 
second code to produce a third code, 

means responsive to the presentation of encrypted 
data for decrypting said data by algorithmically combining it 
with said third code, 

whereby data presented over the communications link as 
an encrypted password, for example, or by the user's computer can 
be decrypted for verification. 

12. The apparatus of claim 11, further comprising 
means for disabling said second code after a 

predetermined usage interval. 

13. A software distribution system for distributing 
software' frcm a central facility to a plurality of users' 
computers such that each distributed copy is usable only with a 
specific user's auxiliary device, comprising the steps of 

generating a unique index code, 

preparing a unique user copy of a selected software 
program by encrypting selected passages of said program in a 
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manner such that a given algorithm operating on said encrypted 
passage and a key specified by said index code will yield the 
plain text version of said passage, 

providing an auxiliary device in which said index code 
can be registered, designed to be interconnected with the user's 
computer, such that when running the program with the encrypted 
passages, normal execution is suspended at each encrypted passage 
and the encrypted passage is decrypted by the auxiliary device by 
algorithmically combining the key specified by said index code 
with the encrypted passage and returning plain text to said 
user's canputer such that there is never a canplete plain text 
version of the software program resident in the user's system 
memory, 

whereby each user receives a different copy of the same 
software program which will only run with his specific auxiliary 
device. 

14. The method of claim 13, wherein said step of 
providing auxiliary devices includes issuing differentiated 
auxiliary devices to said users having unique decryption master 
codes recorded at the central facility, 

before preparing software for delivery, identifying the 
user's auxiliary device and looking up its decryption master 
code, 

then prepa ring the unique copy by encrypting the 

passages of a selected program in a manner such that a given 
algorithm operating on (1) a key produced by a combination of the 
index code and the user's master code and (2) the encrypted 
passage will yield a plain text version of the passage. 

15. The method of claim 13, further comprising 
automatically disabling the index code in the auxiliary device 
upon the occurrence of a predetermined condition, 

whereby the user's copy of the program is automatically 
disabled, for example, after a predetermined time interval. 
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16. The method of claim 13, wherein at least sate of 
the encrypted passages of the program are software instructions 
themselves. 

17. The method of claim 13, further oorprising the 
step of scrambling the order of the modules in the user's oopy to 
frustrate comparison with another version of the program. 
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